Tycoon2FA

Tycoon2FA is a phishing-as-a-service (PhaaS/PaaS) platform active since 2023 that uses adversary-in-the-middle (AiTM/AitM) techniques to bypass multi-factor authentication by capturing credentials and session cookies during live authentication sessions. It is described as a subscription-based toolkit sold through Telegram for about $120 and has been identified by Microsoft as the most active phishing platform of the year. The platform targets cloud accounts, especially Microsoft 365 and other cloud services, and has been used in large-scale credential harvesting and phishing campaigns. Observed Tycoon2FA tradecraft includes fake CAPTCHA pages, obfuscated JavaScript used to proxy victim credentials to legitimate Microsoft 365 login pages, theft of session cookies after CAPTCHA validation, and automated logins into victims’ Microsoft Entra ID accounts after capturing credentials and MFA tokens. Campaigns have also used anti-bot pages with obfuscated JavaScript, anti-debugger timing checks, browser fingerprinting, URL shorteners, links embedded in legitimate presentation platforms, compromised SharePoint environments, and trusted redirect chains. One reported campaign impersonated a law firm and used a newly spoofed domain to deliver a settlement-agreement signature lure. The content also states that Tycoon2FA now deploys device code flow phishing, indicating expansion beyond its established AiTM phishing capability. In these campaigns, it has targeted cloud environments and Microsoft 365 access through device code phishing lures. Microsoft and Europol disrupted Tycoon2FA in March 2026 in an international operation that seized 330 domains used for phishing pages and control infrastructure. The disruption contributed to a temporary decline in attacks, but reporting indicates the operators rapidly rebuilt infrastructure and resumed operations within days, with activity returning to near prior levels. Post-disruption reporting says the group shifted infrastructure away from earlier hosting patterns and increasingly used second-level domains and .RU domains. No sub-groups are identified in the provided content, and no aliases beyond Tycoon2FA are directly mentioned.